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Introduction 



5 The invention relates to monitoring of computer usage. 
Statements of Invention 

According to the invention, there is provided a computer usage monitoring tool 
10 comprising means for determining which software apphcation is currently executing 
on a computer and for logging usage data to a storage medium, transparently to a 

{ ^ 

user. 

In one embodiment, the tool comprises means for determining the current 
1 5 apphcations by identifying visible windows. 

In one embodiment, the tool comprises means for determining the current 
application by identifying the active window. 

20 In one embodiment, the tool comprises means for recording ah application as 
inactive if its window is active and there are no user inputs for a pre-set time period. 

In one embodiment, the tool further comprises means for capturing window titles 
and using the tides and wdndow handles to identify an application. 



25 



In one embodiment, the tool fiirther comprises means for maintaining window 
foreground and background timers indicating window display times with user input 
and without user input respectively. 
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In one embodiment, the tool further comprises means for maintaining a linked list of 
widows uniquely identified by window handles and title text, and for dynamically 
updating said linked list with new entries. 

5 In another embodiment, the tool further comprises an activation timer which 
activates monitoring at configurable time periods. 

In one embodiment, the tool further comprises means for monitoring user input 
activity between activation by the activation timer. 



Preferably, the tool comprises a frame timer for controlling timing of frame writes to 
a log file. 

In one embodiment, the tool further comprises a log file timer for controlling timing 
15 of log file transfers , 

Preferably, the tool comprises a protection utility comprising means for restarting the 
Data Collection Utility if a user attempts to terminate same and shutdown the 
operating system if a user attempts to terminate the protection utility. 



The protection utility is activated if the user attempts to terminate the collection 
utility. It's purpose is to restart the collection utiUty after a short interval. If the user 
attempts to stop the protection utility it shuts down the operating system. It has no 
association vnth the activation timer. 
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Detailed Description of the Invention 
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The invention will be more clearly understood from the following description of 
some embodiments thereof given by way of example only with reference to the 
accompanying drawings in which:- 
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Fig. 1 is a flow diagram showing tool initialisation; 

Fig. 2 is a block diagram of a data collection utility of the tool; 

5 

Figs. 3 to 9 are flow diagrams illustrating operation of the tool; and 

Figs. 10 to 17 are sample outputs from a data display utility of the tool. 

10 The invention provides a tool for local or remote monitoring of a PC's activity. The 
purpose of the product is to aHov/ a manger easily monitor the use of different 
appUcations by users under his control. 



This offers the following advantages: 

15 

• Determine who really uses different products and allocate licenses 
accordingly. 

• Provide training to the correct users for the correct products 

• Monitor user activity to determine amount of useful time spent on PC 

20 

There are three main components to the program : 



1) Installation 

2) Data CoUection Utihty (DCU) 
25 3) Data Display Utility (PCVIEW) 



The software architecture used allows the tool to be developed from a base tool for 
use in different applications. This allows simple modification of the program to fit 
into a client's product line or to provide additional functionality not contained in the 
3 0 generic product release . 
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The Data Display Utility has a three-layered structure as follows. 
Customisation Laver 

5 The top layer (customisation) allows simple modification of the menus, language, 
toolbars etc in the application. 

Data Analysis Laver 

This allows delivery of a range of products on one core development. 
10 • WorkMon is for use in Corporate Networks. 

• WebMon monitors intemet usage only. 

• HomeMon is for domestic use and operates completely stand alone. 

• CallMon is tailored for Call Centres usage. 

• CollegeMon is for colleges. 

1 5 • TeleMon is specifically designed for Tele workers (ext to WorkMon). 

The Data analysis is particular to each target area. In some cases only the data 
analysis and display sections change to provide these different products as in most 
cases the same collection program can be used. 



20 
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Data Management Laver 

This defines the database support. 

The Data Collection Utility (DCU) also has a three-layered architecture as follows. 
Customisation Laver 
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The top layer (customisation) allows simple modification of the window, menu, 
language etc in the appUcation. Note that many of the application areas will not 
require any user interface on the Data Collection Utility. 



Data Collection Layer 



This allows delivery of a range of products on one core development. The data 
collection routines may be adapted to suit a particular application area, however it is 
unlikely that these will change much for most implementations. 

Data Transport Layer 

This allows use of different transport mechanisms for different application areas. 
RemoteMon may use email to transfer log files whereas LiveMon may use TCPIP to 
transfer information Uve to a server. 

Regarding installation, there are two installations programs required: 

• Data Display Utihty installed on Manager's PC's (PCView) 

• Data Collection Utility installed on each user PC (DCUAPP) 

The installation program as shipped performs the following functions : 

1) Checks required disk space 

2) Creates install directory (user configurable) 

3) Installs PCView including external components as required. 

4) Generates install for DCU. The installer should allow a number of settings to be 
configured for the DCU install as follows :- 

• Install Directory 

• LOGFELE directory. (to copy logfiles) 

• Frame Interval (See DCU) 

• DCU Snapshot interval (See DCU) 

• IDLE time value (See DCU) 



• . . # 
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• LOGFILE transfer options 
Select one or all: 

• Startup 

• Shutdown 

• Manager specified Interval 

• Manager specified times. 

Note: This install can be created on a floppy disk if required. 



The DCU Install performs the following fiinctions: 
10 1) Checks required disk space 

2) Creates directory (as defined during Master Install) 

3) Instedls program files with predefined settings 

4) Creates registry entry to automatically start DCU each time Windows95 starts. 



1 5 The user can not change any parameters once the DCU install has been created. The 
settings by which the Data Collection Utility operates are stored in a configuration 
file and can only be overwritten by a new install prepared by the Manager (except 
LiveMon which includes the option to update settings Live over the network 
cormection. 

20 

The tool is initiaUsed as shown in Fig, 1. This illustrates that Snapshot, Frame, and 
TransferFiles timers are initially set up. A Live Mode server allows remote real time 
monitoring. 



25 The data collection part of PCmon resides on the user PC and is executed on start- 
up. The purpose of the DCU is to silentiy record all user activity on a particular PC. 
The monitor utility does not adversely affect PC performance. The architecture of 
the appUcation is modular such that new or different functionality can be easily 
integrated into the design. 
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The functionality of the DCU can be broken into three modules:- 

• Data Collection 

• Data Storage 

• Data Transfer 

The architecture is shown in Fig 2 and Figs 3 to 9 show its operation in detail. 
Data Collection 

The Data Monitor Module (DMM) is called on the expiry of a configurable timer 
(default = lOsecs) and performs the following actions: 

1) Checks for a Mutex to indicate that DCUStop is running indicating that the 
Collection Utility should terminate. DCUStop is a password protected 
application which allows a user or manager to terminate DCUAPP. It will also 
be used by the install utility to stop DCUAPP when upgrading software. It 
operates by setting a shared Mutex which is monitored by the DMM every time 
it is started. If the Mutex is set the DMM records an alert to the logfile 
indicating that it was terminated by the Mutex. 

2) DMM checks if there has been any keyboard or mouse activity (see monitoring 
keyboard and mouse activity) and if not increments an idle timer count. Once 
this timer exceeds a user configured value (default 2 minutes) an idle task is 
logged to the logfile and all applications on PC are marked as background tasks. 

3) Following these checks the DMM scans through aU the top-level wdndows on the 
PC. This is achieved using the WIN32 API call Enum Windows which calls an 
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application defined callback function with the window handle of each window. 
Within the callback function the DMM: 

• Checks that the window is visible using the Microsoft IsWindowVisble function 
5 and if it is not ignores that window and moves onto the next. 

• Gets the title bar text from the window using the GetWindowText function 

• It checks the text for certain conditions including null text and "Program 
Manager" in which case it ignores the window and moves onto the next. 

• Then DMM searches it's internal data store (IDS) to see if it already has a record 
10 of this window handle. If the handle is not found or the window text has changed 

since the last iteration of the counter a new record is created. (See creating a new 
record below) 

• Finally the DMM increments either the foreground task counter or background 
task counter for the current record based on the value returned by the 

15 GetForeground Window Function. Note tiiere will be only one active window at 

a time indicating the appUcation currently in use by the user. 

The DMM returns to sleep until the snap interval timer expires again. 

20 Creating a new record 

The records are stored internally in a linked Ust to allow dynamic length lists and so 
the usual linked Ust management routines are performed to add new elements. 
Various details are stored in each record including computer name user name current 
25 time, OS Version, window tide text, appUcation name as weU as a background and 
foreground time counters. The foreground timer is only incremented if the current 
window is the active window as indicated by the GetForegroundWindow function. 
The background timer is incremented if the window is visible on the desktop but 
does not have the current focus. 
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The difficult element to populate is the application name as there is no function 
available, which will return the apphcation name associated with a particular 
window handle. 

Under Windows NT the application name is obtained by reading the performance 
data statistics available in the registry. The code finds the process ID for the window 
handle using GetWindowThreadProcessId and then searches through the 
performance statistics for a matching process ID. The file name of the executable 
responsible for creating the window is included in the performance data and this is 
extracted by DCUAPP. 

Under Windows 95/98 the performance data is not available and instead DCUAPP 
uses the toolhelp library available on this platform. This works by taking a snapshot 
of all the rurming processes and scanning through each one that has a *.exe' or *.scr* 
application filenameextension for the one with a process ID that matches the process 
ID associated with the current window handle. 

Monitoring keyboard and mouse activity 

To find out if the user is actually using the PC the Data Monitor must also check for 
mouse and keyboard activity. This is achieved by using the standard function 
SetWindowsHookEx to hook all keyboard and mouse messages for the sysferh/ This 
routine simply allows a callback function to be setup to intercept these messages and 
in the case of DCUAPP a counter is incremented each time a key is pressed. The 
keystroke or mouse message is passed back to the system for normal processing. 
When DMM queries the counters they are reset to zero hence this can be used to see 
if there has been any activity in the interval since the last snap shot. Since there is 
virtually no computation in the callback function the affect on the performance of the 
system is minimal. In the future this algorithm may need to be expanded to take 
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account of voice activated systems, Infra Red and other forms of man machine 
interfaces. 

Data Storage 

5 

The data records held by the Internal Data Storage module are backed up to disk 
automatically by a user configurable timer (default 5 minutes). The files are stored in 
a binary format to make it difficult for users to modify the data. There are plans to 
compute checksums to detect tampering with the data. Once stored to disk obsolete 
10 elements of the internal store are deleted, the counters for active elements are reset. 
The process continues updating and adding to the records. 

There is an additional option here to transfer the records over a live TCPIP link 
allowing the manager to have a live view of a particular computer. In this instance 
the data is formatted and transferred to an application running on the manager PC. 
This link can also be used to customise operating parameters of the Data Collection 
Utility including timers and log file directories. 

Data Transfer 

The Data Transfer Module is responsible for transferring log files to a central server 
for interpretation by the Data Display Layer. Once copied the files are deleted from 
the user PC. 

Security 

There are a number of measures incorporated into the product to ensure that the data 
collected is a true representation of the activity on the users PC. These include: 
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1) DCUAPP protection. Should a user attempt to stop the data collection utility' 
using task manager the data collection utility will detect this and immediately 
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start a second application before terminating itself. The new application will start 
the collection utility about 10 seconds later. Any attempt to kill the protection 
utility will cause the PC to shutdown immediately. 

2) Alert Log Mechanism. As well as storing application data to the log files the data 
collection utiUty stores alerts which include details like USER LOGIN, 
SHUTDOWN, etc. More importantly alerts are used to log attempts to stop the 
data collection utility. 

3) Since the application is started by a registry setting the user may attempt to 
change this. This wiU mean that no records will be recorded for that user hence 
alerting the manager to a problem. Additionally since the product is a data 
monitor any attempt to tamper with the registry settings will be seen in the 
logfiles providing that the snapshot interval is not increased above a reasonable 
level. Using the Uve version of PCMON will highlight this weakness 
inmfiediately. 

Data Display Utility (PCView) 



The data display utility is written in Visual Basic™ and uses Access™ to provide the 
database functionality. The Data Display program (PCView) operates as a 
standalone application and has a standard Multiple Document Interface(MDI). 
PCView allows the user to read in new data files load, generate new, load, save and 
print reports. It also allows the user to input 'friendly' names for applications and 
group data. It supports both text and graphical reports. 

The main menu has the following options :- 

• Report Manager - Brings user to report menu 

• Data Manager - Allows data management functions 
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• Customize 

• Exit 



Configuration options 
Close application and quit. 
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#1 
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The following data is available to 
Current Time 
Frame Interval 
Snapshot Interval 
Application name 
Window Title bar Text 
Foreground Time 
Background Time 
User Name 
Computer Address 
Operating System Version 
PCMON Version 



the display utility: 

- Start time of frame 

- Frame size in seconds 

- Snapshot interval in seconds 

- Module name of process that created window 

- Text displayed on Title bar of window 

- Amount of time spent as foreground task 

- Amount of time spent as background task 

- Name used to log into Windows 

- Unique Computer ID (e.g. Ethernet address) 

- Details of operating system in use on PC 

- Digit code for current PCMON version 



The following tables are required in the database 



Application List 

njjif ^ 20 This table contains a list of appUcations which may be grouped etc for display 
purposes 

• ID - MSACCESS generated ID 

• Application name 

• Friendly Name 

25 

User List 

This table contains a list of users which may be group etc for display purposes 

• ID - MSACCESS generated ID 

• User name 
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Group 



Identify group belong to 



Computer List 

This table contains a reference to all the PC's in the Log 

• ID - MSACCESS generated ID 

• Computer Address 

• Group - Identify group belong to 
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PC Log 

This table contains the list of records 



ID 

Computer ED 
User ED 
AppID 
Current Time 
Frame Interval 
Snapshot Interval 
Window Title bar Text 
Foreground Time 
Background Time 



- MSACCESS generated ID 

- Use lookup to Computer List 

- Use lookup to User List 

- Use lookup to App List 

- St£ut time of frame 

- Frame size in seconds 



- Snapshot interval in seconds 

- Text displayed on Title bar of window 

- Amount of time spent as foreground task 

- Amount of time spent as background task 
Operating System Version - Details of operating system in use on PC 
PCMON Version - Digit code for current PCMON version 
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Report Manager 

This part is responsible for the display of data and reports. It allows the user to select 
the particular report details and format required and allows the report to be printed to 
hard copy. The user interface is simple and easy to use. Pie charts and bar graphs as 
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10 



15 
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well as tabular reports are available. It is possible to cut and paste to other windows 
applications. 

The User Interface selects data based on the following criteria entered by the 
Manager: 



Date is a special case and should include the following default selections 

• Today 

• This week 

• This Month 

• Last n days/ weeks /months 

• Pick dates manually. 

Once the criteria is entered the UI will allow the User to select the format of the 
display: 

• Chart by App 

• Chart by PC 

• Chart by User 

In the case of a text report the use may select the following fields: 

• Application 

• Machine 

• User 

• Date/Time 



Computer Address 



select single/multiple or predefined group 
select single/multiple or predefined group 
select single/multiple or predefined group 
select range 



• User Name 



AppUcation Name 
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The report type defaults to the last used format and should be selectable for : 

• Bar Chart 

• Pie Chart 

• Text Report 

A sample report screen is shown in Fig. 10. 

Sample reports by user show the amount of time spent by selected users using 
selected applications on selected computers. For example, referring to Fig. 11, "who 
uses Visual Basic™ most? This chart shows that Seamus uses this application most 
and raises the question as to whether he should be sent on a training course. 

The chart of Fig. 12 illustrates who spends most time on PCs. The chart of Fig. 13 is 
an example of one illustrating the amount of time spent using selected computers 
using selected applications by selected users. 

The chart of Fig. 14 illustrates which PCs use an appUcation most. The chart of Fig. 
15 is an example illustrating the amount of time selected applications are used by 
selected users on selected computers. This example suggests that some users may 
need to be sent on an Excel™ course. 



A question such as "which applications are normally run on PC X?" is answered by 
a chart such as shown in Fig. 16. Information about what a particular user does is 
provided by a chart such as shown in Fig. 17. 

Data Manager 



The Data menu gives the manager the option to import new data, if available. By 
default the database is updated automatically each time it is opened. PCMON will 
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check for new log files immediately and update the database. The manager may 
delete a specified set of records, if for example they are confidential or an employee 
is no longer working in the organisation, etc. The manager may archive old data so 
that the database does not become too large and suffer unnecessary performance 
problems due to out of date data. 

Import new data 
Delete Records 
Archive old data 

Included in the Data Manager is a facility to edit the application name to display a 
more user friendly name. Windows includes such modules as MAPIISP32.EXE etc 
which can be replaced by a friendly name e.g. Mail. Also by setting the 'Friendly 
Name* to <NULL> PC View will ignore associated entries. 

Customize 

The customise menu configures various user parameters. Some of the items include 
the auto-archive facility, file location directories, specification of daily working hours 
- used in calculating percentage working times. 



Auto Archive setup 
Log File directories 

Specify Header/Footer for Reports (use to include company logo) 
Define working hours 
25 Restore Factory Default settings 

The invention is not limited to the embodiments described but may be varied in 
construction and detail. For example, the tool may be modified in the following 
aspects. 

30 
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• Log Web Sites rather than pages to reduce amount of data. Currently we 
record window title bar text which represents pages browsed but we could 
replace this by the Web Site name. 

• Immediate log faciUty. A utility which would allow a manger to request the 
current logfile for a particular user inmiediately. i.e. What has user x been 
doing for the last hour? ( Leave this as part of LiveMon??) 

• End User Software Development Kit allow OEMs to change ^splash screens', 
configuration, title bars. 

• Provide support for Database engines other than Microsoft Access^^. 

• Present data in html format for display using Web Browser. 

It wdll be appreciated that the invention provides many advantages for human 
resource management and computer/ application maintenance. These include the 
following. 

Active monitoring of all PC applications by default, no user configuration required. 

Records changes in Window titles, allows monitoring of web site access, email, 
documents opened. 

Distinguishes between background and foreground tasks. 
Records time spent using apphcations 

Provides comprehensive Data Display Utility to present results in simplified chart 
formats for analysis 

Protection against power loss and meilicious intmsion. 

Can be used locally on single PC or transmit files to central location. 
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Does not interfere in PC operation and user may be unaware of presence of PCMON 
(entry in task list only). 

Modular design allows ease of integration with other products and upgrading 
functionality to include features such as Uve on line reporting of PC activity to host 
PC. 

Supports clipboard to allow transfer of reports to applications such as work 
processing applications. 

The invention is not limited to the embodiments described but may be varied in 
construction and detail. 
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Claims 

1. A computer usage monitoring tool comprising means for determining which 
software applications are currently executing on a computer and for logging 
usage data to a storage medium, transparendy to a user. 

2. A tool as claimed in claim 1, wherein the tool comprises means for determining 
the current appUcations by identifying visible windows. 

3. A tool as claimed in claims 1 or 2, wherein the tool comprises means for 
determining the current active application by identifying an active window. 

4. A tool as claimed in claims 1, 2 or 3, comprising means for recording an 
appUcation as inactive if its window is active and there are no user inputs for a 
pre-set time period. 

5. A tool as claimed in any preceding claim, further comprising means for capturing 
window tides and using the titles and window handles to identify an application. 

6. A tool as claimed in any preceding claim, further comprising means for 
maintaining widow foreground and background timers indicating window 
display times with user input and without user input respectively. 

7. A tool as claimed in any preceding claim, further comprising means for 
maintaining a linked list of widows uniquely identified by window handles and 
tide text, and for dynamically updating said linked list with new entries. 

8. A tool as claimed in any preceding claim, further comprising an activation timer 
which activates monitoring at configurable time periods. 
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9. A tool as claimed in claim 8, further comprising means for monitoring user input 
activity between activation by the activation timer. 

10. A tool as claimed in any preceding claim, wherein the tool comprises a frame 
timer for controlling timing of frame writes to a log file or to an open network 
connection. 

11. A tool as claimed in any preceding claim, further comprising a log file timer for 
controlling timing of log file transfers. 

12. A tool as claimed in any preceding claim, wherein the tool comprises a protection 
utility comprising means for restarting the Data Collection Utility in the event of 
a user attempt to terminate same and shut down the operating system if a user 
attempts to terminate the protection utility. 

13. A computer usage monitoring tool substantially as described with reference to the 
drawings. 
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Initialise LiveMon Server 



Transfer Log Files 



Record Startup Alert 



Reads Configuration settings 
from the system registry 



The application intercepts 
keyboard and mouse messages 
to allow the coDection utility to 
determine if there is user activity 



Sets up the following timers 

- Snapshot Timer 

- Frame Timer 

- Transfer Files timer 



Live mode allows a remote user 
to connect to the user PC and 
monitor user activity in real-time. 
The Live Mode server must be 
running on the User PC to allow 
remote connections 



Records a record in the Log File 
to indicate the time the utility 
started at 
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Main Event Routine 



Snap Shot Ttmer CaUback 
Frame Timer Callback 
Transfer Rle Callback 



Windows Shutdown 



End Task Request 



Record Alert indicating attempt 
to stop DCU 



Record Alert 



Save records in memory to file 



Attempt to transfer existing log 
files including alert 



Start Protection utility which 
restarts collection utiliy after 
preset timeout 
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The collection utility waits on the 
three timer events and a number 
of windows events 



See Relevant Pages 



Record shutdown time in an alert 



Save records in memory to file 



When windows is shutdown the 
cottedion engin e attempts to 
transfer any tog files to the 
central storage directory 



Snapshot Timer Callback Routine 



The Mulex is used to atow an 
aulhorisecl usw or process to 
terminate the coOection utifity . 
This is required to uninstaO or 
ungrade the coQection engine 




Uses counters to check il there 
has been any keyljoard or m 
ouse messages since the last 
check 



Inftiate Frame Timer 
Callback 



Transfer Files 




Oose DCUAPP 



F>rocess each Window 



The active Window is used to 
determine which window the 
user is working on. If the 
keyboard and mouse is inactive 
tor a certain period the active 
window is ignored and aD 
windowsare treated as inactive. 
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Process Window Callback 



-No- 



Create New Entry 

I Fig ■ e»; 



Fi 




Increment 
foreground timer 



Many wirwiows in the system are 
not visible to the user and we 
can ignore these 



The coUection engine records 
the window text as an indication 
of what the user is doing 



The main *sheir window can be 
ignored as can windows with no 
title text 



The system maintains an 
internal GnJted Bst ot windows. 
The window handle together with 
the title text provide a unique 
identitier. If there is rw record for 
the current window with this text 
a new record is created 



Two counters are used for each 
record* 

- Foregorund counter 

- Backround Counter 

The foreground counter records 
the ewnount of time this window 
has been receiving input from 
the keyboard or mouse. 

Background time indicates that 
the window has been active but 
not the focus of the user input 
devices 



Create New Entry 



AOocate memory 
and set up finked 
fist pointers 






InitiaNse variables 






Get Process ID of 
Process that 
created this 
window 







OS =• NT? 




-No- 



Yes 



Find Performance 
statistics for 
Process D 



Scan Through 
processes using 
Toplhetp routines 



-No 



Yes 



Store APPName 
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^ Return ^ 





hwnd 




snap interval 




username 




ComputerName 




OS Version 


m 


PCMon Version 




Current Time 


EE] 


Window Title 



The next task is to get the name 
of the executable that invoked 
this windo. This procedure is 
different for the different 
opearting systems but is based 
on process ID that created the 
window 



Windows 95/98 

Provides a library of utilities to 
retrieve information on all the 
processes in the system. The 
DCU scans through the 
processes unta 3 finds the 
matching one and can extract 
the excutable name 

Windows HI 

In NT it is possible to retrieve 
performance statitics from the 
registry for afl processes. This 
data includes the executable 
name and so the statistics are 
scanned untfl a match is found 



If an appfication name cannot be 
found, store the taie text as the 
application name. This is a fail 
safe mechaism only. 
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Frame Timer Callback 



Create tog f Be or 
open existing 



The Log fte may otready exist or 
may have been transferred and 
so a new own needs to be 
created 



Load first etemenl 
of fist 



Scan through each element of 
the list and store to tfle 





The frame intreval is usuafly 
fixed but may vary if a remote 
user is connected and requests 
immediate refresh. 



No 




If a remote system is connected 
output the data over the 
newtwork cofif^ction 




Reset counters 




Delete item from 
List 








1 


r 




Increment List 
pointer 





If the wttkIow is no longer in use 
the entry is deleted from the fist 
otherwise the counters are reset 
m preparation to rthe next 
snapshot 



Close FBe 



^ Return ^ 



^^7 



si 13 



Transfer Log Files Callback 




The Log Files are copied from 
the DCU Log File directory to the 
central directory as specified in 
the configuration settings 



Log Files are identified by the 
user name and date and since a 
file of the same name may 
already exist so the DCU 
appends _nn to the filenaem 
where nn is a unique identifier. 

If the file already exists the value 
of nn is incremented until a 
unique filename is found. 



Once the file is copied to the 
storage directory it is deleted 
from the local PC 




Protection Utility 



The Protection Utility sets up a 
timer to resiart the Data 
Collection Utility 



End Task Request 



Timer Event 



Restart DCU 



Shutdown 
Windows 



If an end task request is 
received before the timer expires 
windows is immediately 
terminated. This prevents a 
malicious user from running 
windows without the DCU. 
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Fig. 11 




Fig. 13 




Fig. 14 




□ Statler 
■ Frodo 

□ ApoHo 

□ Mervm 



S Excel 
BWord 

□ Internet 
Explorer 

□ Soliaire 



Fig. 15 
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